CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

5.31 (L1) Ensure 'UPnP Device Host (upnphost)' is set to 'Disabled' (Scored)

ProfileApplicability:

 Level 1 (L1) - Corporate/Enterprise Environment (general use)

Description:

Allows UPnP devices to be hosted on this computer.

The recommended state for this setting is: Disabled .

Rationale:

Universal Plug n Play (UPnP) is a real security risk - it allows automatic discovery and attachment to network devices. Notes that UPnP is different than regular Plug n Play (PnP). Workstations should not be advertising their services (or automatically discovering and connecting to networked services) in a security-conscious enterprise managed environment.

Audit:

Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost:Start

Remediation:

To establish the recommended configuration via GP, set the following UI path to: Disabled .

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\UPnP Device Host

Impact:

Any hosted UPnP devices will stop functioning and no additional hosted devices can be added.

Default Value:

Manual

356 | P a g e